CVE-2026-54478
Fixed in a distro release EPSS <1%CVSS 3.7
In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the RFC 9018 server-cookie SipHash is computed over the proxy's wire address instead of the PROXYv2-declared client. One server cookie obtained through a given proxy node therefore validates for every PROXYv2-declared source behind that node. On a UDP+proxy-protocol front, an off-path attacker can harvest one cookie with a single legitimate query, then replay it under any spoofed source and pass DNS Cookie checks that were deployed to defeat this in the first place.
Products: NLnet Labs unbound
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.22 | unbound | 1.25.2-r0 |
| Alpine 3.23 | unbound | 1.25.2-r0 |
| Alpine 3.24 | unbound | 1.25.2-r0 |
| Debian 12 | unbound | no fix |
| Debian 13 | unbound | 1.26.1-0+deb13u1 |
| Debian 14 | unbound | 1.25.2-1 |
| Red Hat hummingbird 1 | python3-unbound | 0:1.25.2-0.1.hum1 |
| Red Hat hummingbird 1 | unbound | 0:1.25.2-0.1.hum1 |
| Red Hat hummingbird 1 | unbound-anchor | 0:1.25.2-0.1.hum1 |
| Red Hat hummingbird 1 | unbound-devel | 0:1.25.2-0.1.hum1 |
| Red Hat hummingbird 1 | unbound-dracut | 0:1.25.2-0.1.hum1 |
| Red Hat hummingbird 1 | unbound-libs | 0:1.25.2-0.1.hum1 |
| Red Hat hummingbird 1 | unbound-munin | 0:1.25.2-0.1.hum1 |
| Red Hat hummingbird 1 | unbound-utils | 0:1.25.2-0.1.hum1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | unbound | 1.25.2-150100.10.28.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | unbound | 1.25.2-150100.10.28.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | unbound | 1.25.2-150100.10.28.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | unbound | 1.25.2-150100.10.28.1 |
| SUSE Linux Enterprise Micro 5.5 | unbound | 1.25.2-150100.10.28.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | unbound | 1.25.2-150600.23.19.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | unbound | 1.25.2-150600.23.19.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | unbound | 1.25.2-150100.10.28.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | unbound | 1.25.2-150100.10.28.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | unbound | 1.25.2-150600.23.19.1 |
| SUSE Linux Enterprise Server 16.0 | unbound | 1.25.2-160000.1.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | unbound | 1.25.2-150100.10.28.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | unbound | 1.25.2-150100.10.28.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | unbound | 1.25.2-150600.23.19.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | unbound | 1.25.2-160000.1.1 |
| SUSE Linux Micro 6.0 | unbound | 1.25.2-1.1 |
| SUSE Linux Micro 6.1 | unbound | 1.25.2-slfo.1.1_1.1 |
| SUSE Linux Micro 6.2 | unbound | 1.25.2-160000.1.1 |
| Ubuntu 22.04 LTS | unbound | no fix |
| Ubuntu 24.04 LTS | unbound | no fix |
| Ubuntu 26.04 LTS | unbound | no fix |
| Ubuntu 26.10 | unbound | no fix |
| Ubuntu Pro 14.04 LTS | unbound | no fix |
| Ubuntu Pro 16.04 LTS | unbound | no fix |
| Ubuntu Pro 18.04 LTS | unbound | no fix |
| Ubuntu Pro 20.04 LTS | unbound | no fix |
| openSUSE Leap 16.0 | unbound | 1.25.2-160000.1.1 |
| openSUSE Tumbleweed | unbound | 1.25.2-1.1 |